Netlify DNS
Netlify access token setup: create a personal access token that can reach the Netlify team containing your DNS zones; Netlify does not offer a read-only token scope.
On this page
Netlify access token permissions
- Credential type
- Personal access token
- Preview access
- Personal access token (full access to authorized teams)
- Apply access
- Personal access token (full access to authorized teams)
- API endpoint
- DNSMigrator uses the provider's fixed API endpoint.
Additional access
DNSControl id
{
"TYPE": "NETLIFY"
}Create credentials
Create a personal access token that can reach the Netlify team containing your DNS zones; Netlify does not offer a read-only token scope.
Access you'll grant
Personal access token (full access to authorized teams)
Personal access token (full access to authorized teams)
Before you start
- A Netlify user with access to the DNS zones you want to connect.
- For a SAML-based team, sign in to that team with SSO before creating the token.
Setup steps
0 of 6 done
Open Personal access tokens
In Netlify, open Applications → Personal access tokens, then select New access token.
Name and expire the token
Enter a name that identifies DNSMigrator, then choose an Expiration date that covers the migration and verification window.
Authorize a SAML team if required
If the DNS zones belong to a SAML-based team, select Allow access to my SAML-based Netlify team. Netlify denies team access by default for tokens created by SSO users unless you select this option while signed in through SSO.
Generate and copy the token
Select Generate token and copy the value before selecting Done. Netlify will not show the token again after you leave this page.
Find the team slug if needed
Only fill in Team slug when the zones are in a team other than the token's default team. A Team Owner can find it under Team settings → General → Team details → Team information.
Paste the connection values
Paste the token into Personal access token. Add the team account slug to Team slug only when needed, then check access.
Troubleshooting
Netlify rejected the access token
The token is incomplete, expired, or was invalidated by a Netlify password reset. Generate a replacement and paste the complete value.
A SAML team's zones are missing
Create a new token while signed in to the team with SSO and select Allow access to my SAML-based Netlify team.
The zone list is empty or shows the wrong team
Check that the user can access the zones and that Team slug is the account slug for the team that owns them. Remove the slug to use the default team.
Official documentation
Guide checked against the official documentation on .
Credential fields
| Field | Requirement | Where to find it |
|---|---|---|
| Personal access tokentoken | Required | The value shown once after you select Generate token on Applications → Personal access tokens. |
| Team slugaccountSlug | Optional | Optional team account slug from Team settings → General → Team details → Team information; this is not the team display name. |
Capabilities
- Create zones
- Yes
- List zones
- Yes
- DNSSEC
- Not available through this connection
- Minimum TTL
- 60 seconds
- Apex CNAME
- No
- Read only
- No
Record types
- A
- AAAA
- CNAME
- MX
- TXT
- NS
- SRV
- CAA
- ALIAS
- SPF
Caveats
- NETLIFY and NETLIFYv6 site records are read as an ALIAS (apex) or CNAME to the site's netlify.app hostname, and we never change or delete them on Netlify.
- Netlify DNS doesn't support DNSSEC, so turn it off at the registrar before switching nameservers.
- Netlify has no record update endpoint, so each change is a delete followed by a create.
Troubleshooting
- Netlify rejected the access token
- The token is incomplete, expired, or was invalidated by a Netlify password reset. Generate a replacement and paste the complete value.
- A SAML team's zones are missing
- Create a new token while signed in to the team with SSO and select Allow access to my SAML-based Netlify team.
- The zone list is empty or shows the wrong team
- Check that the user can access the zones and that Team slug is the account slug for the team that owns them. Remove the slug to use the default team.